The clandestine officer operating under alias is the most exposed casualty of ubiquitous technical surveillance (UTS). For the generation born after roughly 1990, a lifetime of digital, biometric, financial, and geolocation exhaust has inverted the historical economics of cover: verification is now cheap and fabrication is ruinously expensive. Who foresaw that creating a Facebook for one’s child and a Santa Claus-gifted iPad with geo-locate capability would create the kind of challenge that I argue here. My piece argues that an intelligence service cannot solve this problem by building better legends alone. It must reconceive who it accesses, how it architects cover, how it governs its own data exhaust, and how it turns the same transparency against adversary services. I propose a framework that distinguishes existence attacks from consistency attacks on cover, and I set out three strategic lines of effort (accessions, cover architecture, and counterintelligence governance), a set of tactical adaptations for field operations, and an offensive counterintelligence agenda. The central thesis is that alias survives in the twenty-first century only as a scarce, tiered, short-duration capability, protected by doctrine rather than by artifice.<\/p>\n\n\n\n
I. Introduction: The End of the Analog Legend<\/strong><\/p>\n\n\n\n For most of the twentieth century, the clandestine services enjoyed a structural advantage that they rarely named because it was ambient: verification was hard. A legend built from a forged passport, a plausible employer, a borrowed hometown, and a rehearsed biography could survive because an adversary seeking to falsify it had to dispatch people, query paper registries, and wait. The cost of checking a lie exceeded the cost of telling it. Cover was, in economic terms, a bet that the adversary’s verification budget would run out before the officer’s operational window closed.<\/p>\n\n\n\n That bet has failed. In a September 2026 interview, Moody’s tradecraft executive Jason Lee observed that backstopping was easier before the internet precisely because analog verification was so difficult, and that for anyone raised online it is now nearly impossible to fabricate a background reaching back to childhood without introducing a fatal contradiction (Host, 2026<\/a>). He noted, correctly, that this constraint binds friendly and hostile services alike. The implication for a service director is stark. The pipeline of officers who can credibly operate under a fabricated identity is narrowing toward zero for candidates raised in fully digitized societies, and the last analog cohort is already in its late thirties.<\/p>\n\n\n\n The question this essay addresses is therefore managerial before it is technical: how should the director of a service that runs clandestine and covert HUMINT officers confront a world in which the evidentiary life of every candidate is already written, indexed, and available to the adversary? I argue that the answer requires abandoning the implicit premise that alias is a default competency of the clandestine officer. Alias must instead be treated as a scarce strategic asset, rationed by threat, engineered against specific adversary verification capabilities, and defended by an institutional counterintelligence posture that extends well beyond the officer to the service itself, its contractors, and the officer’s family.<\/p>\n\n\n\n II. Conceptual Framework: Status, Action, and the Evidentiary Life<\/strong><\/p>\n\n\n\n Classical tradecraft distinguishes cover of status<\/strong> (who the officer claims to be) from cover of action<\/strong> (why the officer is doing what he is doing at a given moment). An officer under non-official cover as a commodities trader has a cover of status; the same officer’s explanation for visiting a particular port on a particular afternoon is a cover of action. The distinction matters because UTS attacks the two unequally. Status is a longitudinal claim about a whole life and must be consistent with every record that life has generated. Action is a local claim about a bounded episode and must be consistent only with the records of that episode.<\/p>\n\n\n\n I therefore propose that the analytic unit of modern cover is the evidentiary life<\/strong>: the complete corpus of records, artifacts, images, transactions, biometric enrollments, and third-party testimony that a person’s existence has deposited in systems accessible to an adversary. A legend is a claim about an evidentiary life. An adversary can falsify that claim by two distinct methods, and the director must defend against both:<\/p>\n\n\n\n The two attacks pull in opposite directions. Defending against existence attacks requires the legend to be dense; defending against consistency attacks requires every element of that density to be internally coherent and never to touch the true identity. The more records a service fabricates, the larger the attack surface for consistency. This is the density-consistency dilemma<\/strong>, and it explains why the synthetic-footprint approach that Lee describes, in which agencies fabricate utility bills, tax filings, purchase histories, and decades of AI-managed online activity, is necessary but insufficient. It solves the existence problem at the cost of enlarging the consistency problem.<\/p>\n\n\n\n The dilemma yields a governing principle for the rest of this essay: cover should be engineered to the adversary’s verification capability, not to an abstract standard of realism.<\/strong> A legend need not be perfect; it must cost the specific adversary more to falsify than the operational window is worth. Every recommendation that follows is an attempt either to shorten that window, to raise the adversary’s cost of verification, or to change what must be hidden from identity to activity.<\/p>\n\n\n\n III. The Threat Environment: UTS as Adversary Doctrine<\/strong><\/p>\n\n\n\n UTS is not a single technology but a convergence of five data layers that adversary services now fuse as a matter of routine doctrine. A director must plan against the fused product, not against any single layer.<\/p>\n\n\n\n Four episodes illustrate how these layers have already defeated cover.<\/p>\n\n\n\n Dubai, 2010.<\/strong> The killing of Hamas commander Mahmoud al-Mabhouh is the transitional case. Dubai Police reconstructed the movements of the suspected team from hotel and airport camera footage and publicly named the passports used, which had been issued, forged, or fraudulently obtained in the names of real British, Irish, French, German, and Australian nationals. A single municipal camera network, combined with passport records, unravelled an operation by one of the world’s most capable services within weeks. That was before mass facial recognition.<\/p>\n\n\n\n Salisbury, 2018.<\/strong> After the attempted poisoning of Sergei Skripal, open-source investigators at Bellingcat and The Insider identified the two GRU officers travelling as “Ruslan Boshirov” and “Alexander Petrov” as Colonel Anatoliy Chepiga and Dr. Alexander Mishkin. They did so largely from leaked Russian passport and residency databases, in which service-issued alias passports betrayed themselves through administrative regularities. This is the paradigm consistency attack, carried out by a non-state actor.<\/p>\n\n\n\n The Hague and Ljubljana, 2022.<\/strong> Dutch intelligence stopped GRU illegal Sergey Cherkasov, travelling as Brazilian “Viktor Muller Ferreira”, as he attempted to take up an internship at the International Criminal Court, and later published his legend notes. The same year, Slovenian authorities arrested Artem Dultsev and Anna Dultseva, two illegals living as Argentine nationals, who were later returned to Russia in the August 2024 prisoner exchange. Russia’s illegals program, the most heavily invested deep-alias enterprise in the world, has suffered serial exposure in the UTS era.<\/p>\n\n\n\n OPM, 2015.<\/strong> The theft from the U.S. Office of Personnel Management of roughly 21.5mn background investigation records, including about 5.6mn fingerprint sets, is the most consequential strategic event in this domain. It means that an adversary may hold the true identity, biometrics, family relationships, and foreign contacts of applicants before the service has decided where to deploy them. No legend can survive an adversary who already holds the officer’s fingerprints and security questionnaire.<\/p>\n\n\n\n Two further dynamics complete the picture. First, the asymmetry of tolerance: an authoritarian adversary can fuse domestic surveillance, compelled corporate data, and bought commercial data without legal friction, whereas a democratic service operates under statutory limits on what it may collect about its own population. Second, the commoditization of verification: tools that once required a state are now sold commercially, so even a third-tier service or a criminal organization can run consistency attacks. The Strava heat map episode of 2018, in which aggregated fitness-tracker data revealed the outlines of military facilities, showed that the most damaging disclosures often come not from espionage at all but from ordinary consumer data at scale.<\/p>\n\n\n\n IV. Strategic Line One: Accessions and Selection<\/strong><\/p>\n\n\n\n If the evidentiary life cannot be rewritten, it must be selected for. The first strategic line of effort is to redesign accessions so that alias capability is an assessed attribute of the candidate, measured before hiring and protected from the moment of first contact.<\/p>\n\n\n\n Adversarial vetting.<\/strong> Traditional security vetting asks whether a candidate is trustworthy. A second, parallel assessment must ask whether the candidate is coverable. The service should subject every candidate for alias-designated tracks to the same automated existence and consistency attacks that a hostile service would run, using a red cell equipped with commercially available image search, data-broker products, breach corpora, and, under appropriate legal authority, the categories of data an authoritarian adversary is assumed to hold. The output is a coverability assessment: a structured judgment of how quickly a capable adversary could link this face and this life to a fabricated persona. Lee describes U.S. services already red-teaming their own cover identities; the logical extension is to red-team candidates before they become officers.<\/p>\n\n\n\n Facial exposure as a disqualifying variable.<\/strong> Of all the elements of the evidentiary life, the face is the hardest to mitigate. Text can be explained, accounts can be dormant, but a tagged, indexed photograph posted by a third party will link the officer’s alias to the true identity whenever a camera captures them. Coverability assessment should therefore weight facial exposure above almost every other factor, with particular attention to images the candidate did not post and cannot remove.<\/p>\n\n\n\n Explainable thinness.<\/strong> The ideal alias candidate does not have an empty footprint, which invites existence attacks, but a thin, scattered, or linguistically fragmented one with an ordinary explanation. Promising populations include candidates raised abroad in low-connectivity environments; children of military, diplomatic, missionary, or expatriate families whose records are dispersed across jurisdictions; members of communities that abstain from social media for religious or cultural reasons; and candidates whose early digital life exists principally in a non-English platform ecosystem that Western-built collection tools index poorly. Each must still pass adversarial vetting, because thinness that cannot be explained is worse than density.<\/p>\n\n\n\n Genuine alternate identities.<\/strong> The strongest alias in the UTS era is not fabricated but real. Dual nationals holding a second lawful passport, persons whose names legitimately differ across jurisdictions through transliteration or dual-surname conventions, and persons with a documented second legal name possess an identity that has its own authentic evidentiary life. Such officers can sometimes operate in what is, in documentary terms, a true name that the adversary does not associate with the service. The counterintelligence cost is real: dual nationality carries foreign-influence and loyalty concerns that the security process must weigh explicitly rather than reflexively disqualify.<\/p>\n\n\n\n Harvesting the last analog cohort.<\/strong> Officers born before approximately 1990 had analog childhoods and can still carry a legend whose early decades are plausibly undocumented. They are a depreciating strategic reserve. A director should identify them now, concentrate deep-alias assignments among them, and use their remaining careers to train the doctrine that will replace them.<\/p>\n\n\n\n Non-attributable accession.<\/strong> The OPM breach demonstrated that the hiring process itself can burn officers. Candidates for alias-designated tracks should enter through compartmented pipelines that never touch ordinary personnel systems, never produce a public employment signal, and never appear in records accessible to contractors outside the compartment. The cover employment should be real from the first day, so that the officer’s evidentiary life from that point forward is generated by the cover rather than retrofitted to it.<\/p>\n\n\n\n Early identification within ethical limits.<\/strong> A service may lawfully identify promising candidates at university age through scholarships, language programs, and internships, and may counsel them on footprint discipline from that point. It may not approach minors, and it should not attempt to shape the digital lives of children; that line is both legal and moral, and crossing it would expose the service to catastrophic reputational and counterintelligence risk. The practical horizon is therefore the decade between eighteen and twenty-eight: what exists before that is fixed, but what accrues after it can be governed.<\/p>\n\n\n\n V. Strategic Line Two: Cover Architecture and the Tiered Alias Model<\/strong><\/p>\n\n\n\n The second line of effort replaces the implicit assumption that alias is a uniform competency with an explicit architecture that matches the depth of cover to the verification capability of the adversary and the duration of exposure.<\/p>\n\n\n\n From status to action.<\/strong> The default posture for most clandestine officers should shift toward true-name or true-life cover of status, in which the officer is genuinely who he appears to be (a real executive, academic, engineer, or consultant with a real and unremarkable evidentiary life) and the secret is confined to the cover of action. This does not abolish clandestinity; it relocates it. The adversary may know exactly who the officer is and still not know what he did between two and four on a Thursday in a third country. Defending a bounded episode is tractable in a way that defending a fabricated life is not.<\/p>\n\n\n\n A tiered alias model.<\/strong> Where alias is required, it should be authorized in tiers, each with defined adversary environments, duration limits, and approval authorities.<\/p>\n\n\n\n The value of the tiers lies less in the categories than in the discipline they impose. They force planners to state which adversary capability the cover is engineered against, and they make the scarcest asset, a tier-three-capable officer, visible as a finite resource to be rationed rather than spent.<\/p>\n\n\n\n Alias half-life.<\/strong> Every alias decays from the moment it is first exposed to a camera, a border system, or a device. The service should treat each alias as having a half-life governed by its exposures, track that decay explicitly, and retire identities before they reach a threshold of linkability. The corollary is that aliases are consumables, not property; an officer should not carry the same operational alias across operations in the same adversary environment.<\/p>\n\n\n\n Engineering against biometrics.<\/strong> Because border biometrics defeat document-based alias, deep alias into states with mature biometric enrollment is viable only where the alias identity is itself biometrically enrolled from inception and has never been co-enrolled with the true identity. This makes identities that have never crossed a biometric border in true name extremely valuable, and it argues for preserving certain officers’ biometric virginity in specific jurisdictions as a deliberate career-management decision.<\/p>\n\n\n\n Legend cultivation, not legend fabrication.<\/strong> Lee describes services using AI to generate decades of synthetic footprints and to sustain the present-day online activity of personas. The better model is cultivation over time: identities seeded years ahead of need, allowed to accumulate genuine, low-intensity activity, and audited continuously by the red cell for consistency. A cultivated legend fails existence attacks less often because much of its density is authentic. It must, however, be isolated from every element of the officer’s true evidentiary life, including devices, payment instruments, and the networks from which it is maintained.<\/p>\n\n\n\n Cover of organization.<\/strong> Individual cover is only as strong as the institutional cover behind it. Commercial cover entities must be real businesses with real revenue, real customers, real regulatory filings, and real staff, because a consistency attack will examine the entity before it examines the officer. A cover company whose corporate records, beneficial ownership disclosures, and payroll do not cohere is a beacon that burns everyone associated with it.<\/p>\n\n\n\n VI. Strategic Line Three: Organizational Design and Counterintelligence Governance<\/strong><\/p>\n\n\n\n The third line of effort recognizes that most cover failures in the UTS era will not originate in the field. They will originate in the service’s own data exhaust, in its contractors, and in the private lives of officers’ families. Counterintelligence must therefore be redesigned as a governance function over the service’s entire informational perimeter.<\/p>\n\n\n\n A cover integrity directorate.<\/strong> Responsibility for cover is traditionally dispersed among operations, support, security, and technical components, each of which treats it as a secondary concern. A director should consolidate it in a single cover integrity element with authority over legend cultivation, alias tier approvals, adversarial vetting, and continuous red-team auditing of active identities. Its performance should be measured by a small set of explicit metrics: mean time for the red cell to link an active alias to a true identity, the proportion of active aliases audited per quarter, and the number of exposures traced to institutional rather than individual causes.<\/p>\n\n\n\n Institutional data minimization.<\/strong> The service generates its own exhaust: procurement records, building access logs, vehicle registrations, contractor rosters, parking permits, conference attendance lists, and the location data of every device that enters its facilities. Each is a potential seam for a consistency attack. Data minimization, the deliberate refusal to create records that need not exist, must become a security discipline equal in status to classification. Where records must exist, they should be dispersed across entities that do not reveal their relationship to the service.<\/p>\n\n\n\n The family as attack surface.<\/strong> An officer’s spouse and children have their own evidentiary lives, and they are usually far less disciplined than the officer’s. A teenager’s tagged photograph of a parent at a school event, a spouse’s location-enabled post from a posting abroad, or a relative’s genealogy-site profile can collapse years of cover discipline. Family security programs must move from briefing to sustained support, including practical assistance with privacy settings, data-broker removal, and image-tagging controls, offered as a benefit rather than imposed as a restriction. The ethical boundary is firm: the service may educate and assist family members, but it may not surveil or coerce them.<\/p>\n\n\n\n Contractor and supply-chain discipline.<\/strong> The modern service depends on contractors for technology, logistics, and analysis, and every contractor relationship generates records. Contractors who support alias-designated personnel should be compartmented, audited for their own data practices, and contractually bound to minimization standards. A contractor’s breached customer database can burn officers as effectively as a hostile service.<\/p>\n\n\n\n Policy leverage over the data market.<\/strong> A service director cannot unilaterally shrink the commercial data ecosystem, but he can make the case to policymakers that adversary access to it is a counterintelligence threat. The United States has begun to act, through the Protecting Americans’ Data from Foreign Adversaries Act of 2024 and the executive order and Justice Department rule restricting bulk transfers of sensitive personal data to countries of concern. A director should treat these measures as the beginning of a strategic campaign to raise the adversary’s cost of verification, and should advocate for their extension to data categories, such as precise geolocation and biometric templates, that most directly threaten cover.<\/p>\n\n\n\n Counterintelligence as a design input.<\/strong> The counterintelligence component should hold formal concurrence authority over cover architecture, not merely an advisory role after the fact. Every tier-two and tier-three alias, every cover entity, and every cultivated legend should carry a documented counterintelligence assessment of which adversary verification capabilities it was engineered against and which it was not.<\/p>\n\n\n\n VII. Tactical Adaptations in Field Operations<\/strong><\/p>\n\n\n\n Strategy determines who the officers are and what cover they carry; tactics determine whether that cover survives contact. The adaptations below are framed as doctrine rather than technique, because their value lies in changing the default assumptions of operational planning.<\/p>\n\n\n\n Plan against the fused picture.<\/strong> Every operational plan should include a written UTS estimate for the operating environment: which biometric systems the officer will cross, which camera networks cover the operational area, what commercial location data is likely available to the adversary, and which of the officer’s own records the adversary may already hold. An operation that cannot state its UTS estimate is not ready for approval.<\/p>\n\n\n\n Compress exposure windows.<\/strong> Because verification is now fast, time is the officer’s most valuable protection. Operations should be designed to minimize the duration of alias exposure in any given environment, favoring short, purposeful episodes over extended residence. The shorter the window, the less the adversary’s verification capability matters.<\/p>\n\n\n\n Displace contact to third countries.<\/strong> Meetings with sources from tier-one adversary states should, wherever possible, occur in third countries with weaker data fusion and no intelligence-sharing arrangements with the adversary. This reduces both the officer’s exposure and the source’s, and it allows true-name or tier-one cover to substitute for deeper alias.<\/p>\n\n\n\n Normalcy over sterility.<\/strong> The pattern-of-life analysis that Lee describes, which correlates anonymous devices that repeatedly co-locate, punishes anomalies. Paradoxically, an officer whose device vanishes from the network for two hours is as anomalous as one whose device sits beside a source’s. Doctrine should therefore favor behavioral normalcy, in which operational acts are embedded in a plausible routine, over attempts at total digital invisibility, which UTS detects as a signal in its own right.<\/p>\n\n\n\n Shift volume from physical meetings to secure communications, and audit those too.<\/strong> Fewer in-person meetings in denied areas means more reliance on covert communications. Those systems are themselves a target. Reuters’ 2022 investigation into a network of CIA covert communication websites, which it found could be identified through shared technical characteristics, is a warning that digital channels carry their own consistency signatures. Covert communications must be red-teamed with the same rigor as aliases, and no single channel should be shared across unrelated sources.<\/p>\n\n\n\n Open the door for volunteers.<\/strong> The most efficient response to UTS may be to reduce the number of approaches officers must make. CIA’s 2023 Russian-language videos, which publicly explained how prospective sources could make contact securely, illustrate a model in which the service advertises a protected door and allows the volunteer to walk through it. The tradeoff is a higher burden on counterintelligence vetting, because dangles will use the same door.<\/p>\n\n\n\n Lean on liaison.<\/strong> Partner services whose officers have different evidentiary lives, different nationalities, and different biometric histories can operate where a service’s own officers cannot. Liaison relationships should be cultivated as a deliberate hedge against cover attrition, while recognizing that every liaison arrangement creates its own counterintelligence exposure.<\/p>\n\n\n\n Exposure accounting after every operation.<\/strong> After each operation, the officer and the cover integrity element should record every exposure the alias incurred: cameras, borders, devices, transactions, and contacts. That record feeds the alias half-life model and informs the decision whether the identity can be used again. A culture that treats aliases as consumables must count what it consumes.<\/p>\n\n\n\n VIII. Offensive Counterintelligence: Turning Transparency Against the Adversary<\/strong><\/p>\n\n\n\n UTS is symmetric in principle even if it is asymmetric in legal access. The same verification economics that threaten a service’s officers threaten the adversary’s, and a director who treats the problem only defensively surrenders half its strategic value.<\/p>\n\n\n\n Industrialized detection of adversary legends.<\/strong> Lee notes that services now run automated tests to see whether the anomalies they look for in foreign cover stories would also flag their own officers. The offensive application is to industrialize that detection: continuous, automated existence and consistency analysis of persons presenting in sensitive roles, such as foreign students in dual-use research programs, new hires at defense suppliers, and visitors to research, development, test, and evaluation facilities. The Cherkasov case shows the payoff: a legend that survived years of preparation failed at the threshold of the target institution.<\/p>\n\n\n\n Protecting the research enterprise.<\/strong> Lee also observes that open science leaves footprints that adversaries can exploit to infer government intent and to forecast the maturity of emerging technologies. The counterintelligence corollary is twofold. Defensively, the service should help research institutions understand what their aggregate publication, procurement, and hiring signals reveal. Offensively, the same forecasting methods can be applied to adversary research ecosystems to time the emergence of their capabilities.<\/p>\n\n\n\n Deception to raise the adversary’s verification costs.<\/strong> The density-consistency dilemma applies to the adversary’s analysts as well. Anomaly detection depends on a baseline of what normal looks like, and baselines can be shaped. A carefully governed deception program, operating within law and against foreign targets, can increase the number of plausible false positives in environments where adversaries hunt for friendly officers, so that their detection systems generate more leads than their counterintelligence services can resolve. The purpose is not to hide any single officer but to degrade the reliability of the adversary’s model of normalcy.<\/p>\n\n\n\n Double-agent operations aimed at verification methods.<\/strong> Controlled sources inside or in contact with adversary services are the most direct means of learning which data sets, tools, and heuristics they use to falsify cover. Double-agent operations should explicitly task collection against the adversary’s verification doctrine, because knowing which attacks the adversary actually runs allows the service to engineer cover against real rather than imagined capabilities.<\/p>\n\n\n\n Exploiting the adversary’s own exhaust.<\/strong> Authoritarian services rely on centralized databases whose leakage, as Salisbury demonstrated, can expose their officers wholesale. Systematic collection against those administrative systems, and against the regularities in how adversary services issue alias documentation, offers some of the highest-yield counterintelligence opportunities available. Each adversary service that exposes officers through bureaucratic patterns is betting, as Western services once did, that verification will remain expensive.<\/p>\n\n\n\n IX. Risks, Ethics, and Legal Constraints<\/strong><\/p>\n\n\n\n A program of this scope carries risks that a director must name explicitly, because several of its most promising measures sit close to legal and ethical boundaries. (Yes, we do have ethics in the intelligence and counterintelligence disciplines.)<\/p>\n\n\n\n Domestic legal limits.<\/strong> A democratic service’s adversarial vetting and red-cell functions necessarily touch data about its own citizens. Those functions must operate within the service’s statutory and executive authorities, including Executive Order 12333 and its implementing procedures in the U.S. case, with candidate consent obtained as a condition of entering alias-designated tracks and with independent oversight of the red cell’s data holdings. A red cell that itself becomes a domestic surveillance capability would be a strategic failure regardless of its operational value.<\/p>\n\n\n\n Protected categories of cover.<\/strong> Longstanding U.S. policy and statute restrict the use of certain professions, notably journalists, clergy, and Peace Corps volunteers, as cover, because their integrity is a public good. The pressure to find credible cover of status in a transparent world will tempt planners toward exactly those professions whose evidentiary lives are most naturally international and unremarkable. Those restrictions should be reaffirmed, not eroded.<\/p>\n\n\n\n Synthetic identities and the information ecosystem.<\/strong> Cultivated legends and AI-sustained personas inject fabricated records and activity into commercial and public systems. At scale, this degrades the integrity of the very information environment on which democratic societies depend, and it can harm third parties whose records become entangled with fabricated ones. Legend cultivation should be governed by strict limits on scale, by prohibitions on using the identities of real persons without lawful authority, and by procedures for retiring identities cleanly.<\/p>\n\n\n\n Selection bias and fairness.<\/strong> Selecting for explainable thinness and genuine alternate identities will shift the demographic profile of alias-designated officers toward particular backgrounds. That is operationally defensible, but the service must ensure it is selecting on coverability rather than on proxies that carry no operational meaning, and it must manage the counterintelligence scrutiny of dual nationals with rigor rather than prejudice.<\/p>\n\n\n\n Protection of officers’ identities.<\/strong> As cover becomes scarcer, the legal protection of the officers who hold it becomes more important. The Intelligence Identities Protection Act of 1982 remains the principal U.S. statutory shield, but it was drafted for an era in which disclosure required an insider. In an era in which open-source aggregation can identify officers without any insider, policymakers should examine whether the deliberate aggregation and publication of covert officers’ identities warrants updated legal treatment, while preserving the freedom of the press.<\/p>\n\n\n\n The risk of strategic overcorrection.<\/strong> Finally, a service that concludes alias is dead may overinvest in technical collection and underinvest in human judgment. That would be an error. Human sources remain the only reliable means of learning adversary intentions, as distinct from capabilities, and the purpose of this program is to preserve clandestine human access in a transparent world, not to retreat from it.<\/p>\n\n\n\n My Parting Thoughts<\/strong><\/p>\n\n\n\n The generation born into the digital world is not unrecruitable. It is differently ‘coverable’. The error a service director must avoid is to treat the collapse of the analog legend as a technical problem awaiting a better forgery. It is a structural change in the economics of verification, and it demands a structural response.<\/p>\n\n\n\n That response has three strategic pillars and one organizing idea. The pillars are accessions that select for coverability rather than attempting to manufacture it, a cover architecture that rations aliases in tiers engineered against specific adversary capabilities, and a counterintelligence governance regime that treats the service’s own data exhaust, its contractors, and its officers’ families as part of the perimeter. Tactically, operations must be planned against the fused UTS picture, compressed in time, displaced to third countries where possible, and accounted for exposure by exposure. Offensively, the same transparency that threatens friendly officers should be turned systematically against adversary legends and verification doctrine.<\/p>\n\n\n\n The organizing idea is that clandestinity is migrating from identity to activity. For most officers, the secret of the future will not be who they are but what they do in bounded, defended episodes. For the small number of officers who must still live under another name, alias will be a scarce, expensive, consumable capability, guarded by doctrine rather than by artifice. A service that internalizes that shift early will retain clandestine human access in a transparent world. A service that does not will discover, as Russia’s illegals have, that the adversary’s verification budget no longer runs out. Though the OSINT guys and gals will tout the strength of their discipline, often pointing at statements by I.C. leadership that “ninety percent of our raw collection is now acquisition and almost purely OSINT”, those of us who know something different, know. <\/p>\n\n\n\n This is an evolving issue, on both intelligence and counterintelligence sides of the house. I’ll expand on this in future blog<\/a> insights.<\/p>\n\n\n\n ~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA\/NCISS OSINT certification, DoD\/DoS BFFOC Certification, Criminal Intelligence Analyst Classification 1 (IALEIA), former I.C. Operator<\/a><\/p>\n\n\n\n References<\/strong><\/p>\n\n\n\n <\/p>\n","protected":false},"excerpt":{"rendered":" The clandestine officer operating under alias is the most exposed casualty of ubiquitous technical surveillance (UTS). For the generation born after roughly 1990, a lifetime of digital, biometric, financial, and geolocation exhaust has inverted the historical economics of cover: verification is now cheap and fabrication is ruinously expensive. Who foresaw that creating a Facebook for … <\/p>\n\n
Layer<\/th> What it reveals<\/th> Primary attack it enables<\/th><\/tr> Biometric (border, visa, municipal facial recognition)<\/td> The body behind any document<\/td> Consistency: links alias to true face or iris<\/td><\/tr> Image corpora (social media, scraped photo sets)<\/td> Historical appearance, associates, places<\/td> Consistency and existence<\/td><\/tr> Commercial location and adtech data<\/td> Pattern of life, co-location of devices<\/td> Consistency of action; exposes meetings<\/td><\/tr> Financial and administrative records<\/td> Transaction history, tax, credit, residence<\/td> Existence: tests legend density<\/td><\/tr> Breached and stolen government data<\/td> Clearance files, fingerprints, travel histories<\/td> Both: identifies officers before deployment<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n Tier<\/th> Use<\/th> Permitted environment<\/th> Duration<\/th> Approval<\/th><\/tr> 0: True name<\/td> Default cover of status; secrecy confined to action<\/td> All<\/td> Career<\/td> Station<\/td><\/tr> 1: Light alias<\/td> Discrete transactions (a registration, a single meeting)<\/td> Permissive and semi-permissive<\/td> Hours to days<\/td> Station chief<\/td><\/tr> 2: Operational alias<\/td> Multi-day travel and contact under a backstopped persona<\/td> Semi-permissive; never into tier-one biometric states<\/td> Days to weeks<\/td> Division, with CI concurrence<\/td><\/tr> 3: Deep alias<\/td> Sustained residence under fabricated or genuine alternate identity<\/td> Selected denied areas<\/td> Months to years<\/td> Director, with compartmented CI review<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n \n